CRI-O vulnerable to an arbitrary systemd property injection

🗓️ 30 Apr 2024 09:39:38Reported by GitHub Advisory DatabaseType

CRI-O vulnerable to arbitrary systemd property injection impacting host system via Pod annotation. Testing with CRI-O v1.24 on minikube, as latest v1.29 is incompatible

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	15 Apr 202503:06	–	ibm
IBM Security Bulletins	Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a cri-o security vulnerability (CVE-2024-3154)	4 Jul 202411:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	4 Mar 202615:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in CRI-O affects watsonx.data	14 Aug 202415:42	–	ibm
BDU FSTEC	The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, arises from improper elimination of certain elements. This allows an attacker to perform arbitrary actions on the host system.	27 May 202400:00	–	bdu_fstec
CBLMariner	CVE-2024-3154 affecting package cri-o for versions less than 1.30.1-1	21 Jun 202409:32	–	cbl_mariner
CBLMariner	CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2	12 Jun 202422:23	–	cbl_mariner
Chainguard	CVE-2024-3154 vulnerabilities	26 Apr 202404:15	–	cgr
Circl	CVE-2024-3154	29 Apr 202416:19	–	circl
CNNVD	CRI-O 命令注入漏洞	22 Apr 202400:00	–	cnnvd

Vulners

Node

cri-o cri-oRange≤1.27.5go

cri-o cri-oRange1.28.0–1.28.5go

cri-o cri-oRange1.29.0–1.29.3go

Source	Link
github	www.github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-3154
github	www.github.com/opencontainers/runc/pull/4217
access	www.access.redhat.com/security/cve/CVE-2024-3154
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/opencontainers/runtime-spec/blob/main/features.md
github	www.github.com/advisories/GHSA-2cgq-h8xw-2v5j

01 May 2024 13:06Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.2

EPSS0.00369

SSVC

CWE-77